What authentication requirements exist for 2024-25 bulk sender rules (Gmail/Yahoo)?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
In early 2024, Google and Yahoo rolled out new requirements for senders hitting more than 5,000 messages per day to their users. Here's exactly what they require.
Authentication: Senders must have SPF, DKIM, and DMARC implemented. DKIM keys must be at least 1024-bit (2048-bit recommended). DMARC doesn't need to be at p=reject yet, but p=none is the minimum. The authentication has to be aligned, meaning the signing domains match your From domain.
One-click unsubscribe: Marketing emails must support RFC 8058 one-click unsubscribe (the List-Unsubscribe-Post header), and unsubscribe requests must be honored within two business days. If your ESP doesn't handle this automatically, you need to implement it.
Complaint rate threshold: Sending complaint rates must stay below 0.10% to maintain good standing, and below 0.30% to avoid blocking. Google Postmaster Tools is the tool to monitor complaint rates for Gmail deliverability.
These rules apply to bulk senders specifically, but it's worth treating them as the baseline for any legitimate email program regardless of volume. The good news is that if you're using a reputable ESP, most of these are handled automatically. The one that catches people is often DMARC, especially if it's not set up at all.
Our free SPF checker, DKIM record lookup, and DMARC parser can confirm your current authentication status in a few minutes.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
